Oh that's a great question and you will hopefully get some interesting responses.
My 2c worth
I deal mostly with wireless customers, and they want to achieve some pretty basic requirements - it's very often either
1) Get rid of PSK SSID's and replace them all with a single SSID (802.1X) - and EAP-PEAP to start with - the benefit is reduction in SSID's and better visibility because of the auth logs to see who logged in and the ability to block people based on their AD account status and AD Security Grouping
2) Get rid of EAP-PEAP (because it's being abused for BYOD purposes and gotten out of control!) with EAP-TLS for the ultimate security. It's the ultimate goal of many of my customers.
I don't have wired customers (yet) but from what I hear they want to implement 802.1X on all of their visible patch points to prevent rogue devices being attached (whether it be PC's or AP's). Even AP's now support 802.1X and that makes life somewhat simpler.
Visibility is the other point. I have a customer who has 1300 NPS servers and there is no consolidated Log dashboard. They are migrating it all to a central ISE deployment - the end result is one reporting dashboard!
I have yet to come across any customers who want PxGrid, TrustSec, Threat Centric NAC, Posturing or BYOD. Those seem much harder to sell these days. I think the low hanging fruit is 802.1X everywhere and now iPSK is a killer app for the IOT devices. And Profiling is becoming more prevalent for me in cases where customers have so many unknown devices but they just want to magically assign them to various VLANs without too much fuss.
